Boost Mobile is a prepaid wireless carrier brand operated by EchoStar Corporation (Nasdaq: SATS), the Englewood, Colorado media/wireless conglomerate that also owns DISH, Sling TV, Hughes, and HughesNet. Boost's privacy policy (effective January 1, 2026) discloses collection of call/data usage history, location, browsing/app activity, biometric identifiers for fraud detection, and children's geolocation via the Boost Family Guard add-on, and its CCPA table states the company sells or shares identifiers, geolocation, and internet-activity data with data analytics providers, advertising partners, social networks, and data brokers by name. Boost's own policy discloses onward disclosure to "EchoStar and EchoStar affiliates." EchoStar Corp is a public, SEC-reporting company controlled by a single principal stockholder (Chairman/President/CEO Charles Ergen). Its corporate parent DISH Network disclosed a February 2023 ransomware attack in an SEC 8-K; a follow-up 10-Q states customer databases were not accessed but employee records and a limited number of other records containing personal information were extracted, at roughly $30 million in remediation cost. No FCC enforcement action specific to Boost or its location-data practices was found.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
6 ON FILE
[2026-01-01] · COLLECTION
Boost Mobile's Privacy Notice (effective January 1, 2026) states that usage information collected whenever a customer uses its services includes call and data usage history, location, websites visited, and applications purchased, downloaded, or used; its state-privacy-law sensitive-information table separately lists precise geolocation and biometric information as categories collected, for identity verification/fraud prevention. The same notice describes Boost Family Guard, a parental-control add-on run with vendor Smith Micro, which collects a child's precise device geolocation and internet usage/browsing history (each stored 7 days) with parental consent, usable only to provide the service and deletable by canceling the subscription.
EchoStar Corporation's Form 10-K for fiscal year 2025, filed with the SEC on March 2, 2026, states the company is incorporated in Nevada, headquartered in Englewood, Colorado, and that its Class A common stock is quoted on the Nasdaq Global Select Market under the ticker SATS. The same 10-K's risk-factor section discloses that EchoStar "are controlled by one principal stockholder" who serves as its Chairman, President, and Chief Executive Officer, meaning minority public shareholders have limited influence over corporate governance and any decisions affecting Boost Mobile's data practices.
Boost's CCPA "Categories of Personal Information Sold or Shared" section states the company sells or shares identifiers, imprecise geolocation, inferences, commercial information, and internet/network activity information, naming the recipient categories as data analytics providers, advertising partners and/or networks, social networks, and data brokers. The notice's "Personal Information We Disclose" section separately states Boost discloses personal information to EchoStar and named EchoStar affiliates (AirTV, DISH, Hughes, HughesNet, and Sling TV), and permits disclosure of customer name/postal address to charities and marketing organizations for mailing-list purposes.
DISH Network Corporation and DISH DBS Corporation's joint Form 8-K, dated February 28, 2023, disclosed that a network outage affecting internal servers and IT telephony was determined to be a cyber-security incident, that appropriate law enforcement was notified, that data was extracted from its IT systems, and that it was possible the extracted data included personal information; DISH, Sling, and its wireless and data networks (which include Boost) remained operational throughout.
DISH Network's Form 10-Q for the quarter ended March 31, 2023 states the investigation into the February 2023 incident was substantially complete, that customer databases were not accessed, but that employee-related records and a limited number of other records containing personal information were extracted, and that DISH incurred approximately $30 million in cyber-security-related expenses in the quarter.
The privacy notice states Boost and companies it works with may use cookies, web beacons, pixels, and tags, and separately discloses use of session-replay software on its own Services that collects keystrokes, mouse movements, and form-field entries. It also directs users seeking to opt out of interest-based advertising to the Digital Advertising Alliance and Network Advertising Initiative opt-out portals and names two ad-tech/identity partners directly, The Trade Desk and LiveRamp, with their respective opt-out pages.